BaseFortify

Publication date: 2025-10-15

Last updated on: 2025-10-16

Assigner: Wordfence

Description

The Zip Attachments plugin for WordPress is vulnerable to unauthorized loss of data due to a missing authorization and capability checks on the download.php file in all versions up to, and including, 1.6. This makes it possible for unauthenticated attackers to delete arbitrary files from the current wp_upload_dir directory.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-10-15

Last Modified

2025-10-16

Generated

2026-07-06

AI Q&A

2025-10-15

EPSS Evaluated

2026-07-05

NVD

CVE-2025-11692

EUVD

EUVD-2025-34547

Affected Vendors & Products

Vendor	Product	Version / Range
wordpress	zip_attachments	1.6

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

The Zip Attachments plugin for WordPress has a vulnerability in its download.php file where it lacks proper authorization and capability checks. This allows unauthenticated attackers to delete arbitrary files from the current wp_upload_dir directory.

Impact Analysis

This vulnerability can lead to unauthorized deletion of files in the WordPress upload directory, potentially causing loss of important data or disruption of website functionality.

Hi! I’m here to help you understand CVE-2025-11692. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70